thctalk.com
May 30, 2026
Database dump from THCtalk (thctalk.com), a cannabis-themed discussion forum running vBulletin software. The breach contains user account data including usernames, MD5-hashed passwords, salts, email addresses, IP addresses, birthdates, join dates, and extensive forum activity metadata. The data appears to cover users from approximately 2007 onward.
Data found in this dataset
Source files
Expand any file to inspect its column headers and the LLM's field-mapping reasoning, recorded during ingestion.
THCtalk_BF__data__thc1talk_user__thc1talk_user.csv12 columns81,239 rows
File structure
Format: CSV·Delimiter: comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence | LLM assessment |
|---|---|---|---|
| 4 | username | high | [4] header 'username', values are forum usernames (Ragman, lkdj2003, rozmeister, etc.) |
| 5 | password | high | [5] header 'password', values are MD5 hashes (32-char hex strings) |
| 7 | high | [7] header 'email', values are email addresses ([email protected], [email protected], etc.) | |
| 11 | username | high | [11] header 'icq', ICQ is a searchable instant messenger handle |
| 12 | username | high | [12] header 'aim', AIM is a searchable instant messenger handle |
| 13 | username | high | [13] header 'yahoo', Yahoo messenger is a searchable identifier |
| 14 | username | high | [14] header 'msn', MSN messenger is a searchable identifier |
| 15 | username | high | [15] header 'skype', Skype is a searchable contact identifier |
| 36 | dob | high | [36] header 'birthday', values match MM-DD-YYYY format (09-20-0000, 09-07-1973, 01-22-1987, etc.) |
| 37 | dob | high | [37] header 'birthday_search', normalized birthdate in YYYY-MM-DD format derived from birthday field |
| 48 | password | high | [48] header 'salt', cryptographic salt used with password hashing |
| 88 | facebookId | high | [88] header 'fbuserid', Facebook user ID field |
Notes: THCtalk vBulletin user database dump. 121 total columns, 12 contain PII. Column [5] contains MD5-hashed passwords (not plaintext). Column [48] contains password salts. Column [40] contains IP addresses (skipped per exclusion rules). Columns [20], [22], [23], [24] are timestamps (skipped). Remaining columns are forum activity metadata, flags, and internal system data.